Google's Code Search a treasure trove for hackers

Google's new Code Search facility has made systems more vulnerbale to hackers

By
Techworld staff
| Oct 09, 2006

| IDG News Service

Share

TwitterFacebookLinkedInGoogle Plus

Hackers are using Google's new Code Search facility to crack security systems. Security experts have warned that the new search engine enables attackers to find software bugs, password information, and even proprietary code.

Unlike Google's main search engine, Google Code Search peeks into the actual lines of code whenever it finds source-code files on the Internet. Although this will make it easier for developers to search for source code direct and dig up open-source tools they may not have known about, it also means that hackers could find vulnerabilities more easily.

"The downside is that you could also use that kind of search to look for things that are vulnerable and then guess who might have used that code snippet and then just fire away at it," said Mike Armistead, vice president of products with source-code analysis provider Fortify Software.

Attackers could also search code for vulnerabilities in password mechanisms, or to search for phrases within software such as "this file contains proprietary," possibly unearthing source code that should never have been posted to the Internet.

Security experts say that the security implications of Google Code Search are noteworthy, if not earth-shattering.

Skilled hackers may already be able to do this type of search with Google's web search engine, but Code Search is "another tool that makes it a tad easier for the attacker," said Johnny Long, a security researcher with Computer Sciences.

Related

For its part, Google did not have much to say about possible misuse of its new product. "Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement.

Google has never said much about the steps it takes to cut down on this kind of misuse of its search engine, though the issue comes up from time to time. In July Websense used a little known binary search capability within Google's search engine to look for malware on the Internet.

While Google Code Search will probably not have much of an effect on popular open-source projects, which are already heavily scrutinised, it could help ferret out vulnerabilities in lesser known pieces of code, according to Lev Toger, a software developer with Beyond Security.

"Using Google's code search, it's much easier to find interesting code portions," he said. "If your task is to find vulnerability in some random code, this filtering can save you a lot of time. "